When a catastrophic breach occurs at an enterprise like Apex Global Bank, the pivotal question before judges, regulatory commissioners, and juries is not simply "Were you hacked?" but "Did you exercise Due Care and Due Diligence?"
US-CERT issues an urgent vulnerability alert for an Apache framework vulnerability affecting web banking portals. Apex Bank’s CISO publishes an emergency patching policy (Due Care). However, the infrastructure team fails to scan internal clusters to verify the patch was installed across all 42 loan-origination microservices (Failure of Due Diligence). Two months later, attackers breach an unpatched legacy server.
"Doing what a reasonable person would do to protect assets."
"Continuously verifying and inspecting that Due Care is actually working."
Under the legal doctrine of Respondeat Superior (vicarious liability), an employer is held legally responsible for the wrongful acts or negligence of its employees if the actions occurred within the scope of employment.
To protect executive officers and board members from personal liability, Apex Bank must demonstrate an unbroken audit trail of both Due Care and Due Diligence.
In 2017, credit bureau Equifax suffered a breach exposing 147 million consumers. The investigation revealed:
Apex Bank mandates that all laptops must be encrypted with BitLocker. However, the bank never collects encryption status telemetry or performs random inventory checks. An unencrypted laptop containing client data is stolen from a car. How would regulators classify this failure?